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BACKGROUND OF THE INVENTION 

1 . Technical Field 

This invention relates generally to encryption of data, and more particularly, to the testing 
of an encryption function of a device under test. 

2. Background Art 

Figures 1-7 illustrate the operation of a device under test (DUT) which uses cipher block 
chaining for the encryption of a packet of data PI in the form of a data string. The encrypted 
data issuing from the DUT is a function of (i) properties of the data packet (for example packet 
length), DUT settings, and security association (SA) properties, all of which are set and fixed 
(static) prior to operation of the DUT, and (ii) dynamic variables, i. e., initialization vectors, as 
will now be described. 

Since the length of the packet data string PI may be quite long, the DUT includes a 
segmentation function for breaking down the packet into a series of packet segment data strings, 
shown at PI SI, PI S2, PI S3, PI S4, so that packet segment size or length is less than the 
maximum packet size supported by the network. 

The DUT in this example includes four encryption engines, noted at EO, El, E2, E3. 
Each encryption engine includes an encryption algorithm, with each encryption engine EO, El 
including the encryption algorithm AES, while each encryption engine E2, E3 includes the 
encryption algorithm DES. The original packet data string PI is associated with a security 
association (SA) property which indicates and determines the algorithm to be applied thereto (in 
the present example encryption algorithm AES), which indication is passed on and associated 
with each packet segment data string P1S1, P1S2, PI S3, P1S4. 

Initially, each encryption engine has applied thereto a chosen and known initialization 
vector or key, for example, encryption engine EO has applied to thereto initialization vector 
IVAESO, encryption engine El has applied thereto initialization vector IVAES1, encryption 
engine E2 has applied thereto initialization vector IVDESO, and encryption engine E3 has 
applied thereto initialization vector IVDESl. 
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A packet segment data string, for example, packet segment data string PI SI, is applied to 
a cross-switch (CSW) of the DUT (although the packet segment data string is indicated as the 
first data string to be applied to the CSW, the packet segment data strings can be applied in any 
order). As indicated above, this packet segment data string PI SI is associated with SA property 
5 indicating the encryption algorithm to be applied to that data string. An input signal IS is applied 
to the CSW, which input signal IS is a function of the S A property indicating the encryption 
algorithm to be applied. For example, if the SA property indicates that algorithm AES is to be 
applied to a packet segment data string, the CSW will receive the data string and apply it to either 
encryption engine EO or encryption engine El, both of which include the encryption algorithm 

10 AES. The decision whether to select encryption engine EO or encryption engine El depends on 
which such encryption engine is free for operation (if both encryption engines EO, El are free, 
the system is preset to select one of them - if both encryption engines EO, El are in use, the 
encryption engine which becomes free first is selected). 

In the example shown in Figure 1, the packet segment data string P1S1 is applied to the 

15 encryption engine El, which has initialization vector IVAES1 applied thereto. Encrypted packet 
segment data string ePISI, based on the encryption algorithm AES of the encryption engine El, 
issues from the DUT, and has included therewith the initialization vector applied to the 
encryption engine El, i.e., initialization vector IVAES1. 

In a cipher block chaining system such as the present one, the application of an 

20 encryption algorithm of an encryption engine to a data string causes the initialization vector 
applied to that encryption engine to change to another value. Thus, as indicated in Figure 2, 
encryption engine EO has applied to thereto initialization vector IVAESO, and encryption engine 
El has applied thereto (new) initialization vector IVAES2 (encryption engines E2 and E3, which 
include encryption algorithm DES not used in the present example, are removed from the 

25 drawings for clarity). 

Another packet segment data string, for example packet segment data string P1S2, is 
applied to the CSW. This data string P1S2 also is associated with SA property indicating that the 
encryption algorithm AES is to be applied thereto, as described above. Again, the CSW will 
receive the data string and apply it to either encryption engine EO or El (both of which include 

30 the encryption algorithm AES), with the selection of encryption engine EO or El based on the 
criteria described above. 

With reference to Figure 3, assuming that encryption engine EO is selected, the packet 
segment data string P1S2 is applied to encryption engine EO, which has initialization vector 
IVAESO applied thereto. The encryption engine EO applies encryption algorithm AES to the 

3 5 packet segment data string P 1 S2, so that encrypted packet segment data string eP 1 S2, based on 
the encryption algorithm AES of the encryption engine EO, issues from the DUT, and has 
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included therewith the initialization vector applied to the encryption engine EO, i.e., the 
initialization vector IVAESO. 

As described above, the application of an encryption algorithm of encryption engine to a 
data string causes the initialization vector applied to that encryption engine to change to a new 
5 value. Thus, as indicated in Figure 4, encryption engine EO now has applied thereto (new) 

initialization vector IVAES3, and encryption engine El has applied thereto initialization vector 
IVAES2. 

Next, another packet segment data string, for example packet segment data string PI S3, is 
applied to the CSW. This data string P 1 S3 also is associated with S A property indicating that the 

10 encryption algorithm AES is to be applied thereto, as described above. Again, the CSW will 
receive the data string PI S3 and apply it to either encryption engine EO or El (both of which 
include the encryption algorithm AES), with the selection of encryption engine EO or El based 
on the criteria described above. 

With reference to Figure 5, assuming that encryption engine El is selected, the packet 

1 5 segment data string PI S3 is applied to encryption engine El, which has initialization vector 
IVAES2 applied thereto. The encryption engine El applies encryption algorithm AES to the 
packet segment data string P1S3, so that encrypted packet segment data string ePlS3, based on 
the encryption algorithm AES of the encryption engine El, issues from the DUT, and also has 
include therewith the initialization vector applied to the encryption engine El, Le., initialization 

20 vector IVAES2. 

As described above, the application of an encryption algorithm of encryption engine to 
a data string causes the initialization vector applied to that encryption engine to change to a new 
value. Thus, as indicated in Figure 6, encryption engine EO has applied thereto initialization 
vector IVAES3, and encryption engine El has applied thereto (new) initialization vector 

25 IVAES4. 

Next, another packet segment data string, for example packet segment data string P1S4, is 
applied to the CSW. This data string PI S4 also is associated with SA property indicating that the 
encryption algorithm AES is to be applied thereto, as described above. Again, the CSW will 
receive the data string P1S4 and apply it to either encryption engine EO or El (both of which 

30 include the encryption algorithm AES), with the selection of encryption engine EO or El based 
on the criteria described above. 

With reference to Figure 7, assuming that encryption engine El is selected, the packet 
segment data string P1S4 is applied to encryption engine El, which has initialization vector 
IVAES4 applied thereto. The encryption engine El applies encryption algorithm AES to the 

35 packet segment data string P1S4, so that encrypted packet segment data string ePl S4, based on 
the encryption algorithm AES of the encryption engine El, issues from the DUT, and also has 
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include therewith the initialization vector applied to the encryption engine El, i.e., initialization 
vector IVAES4. 

This example illustrates and describes the segmentation of a single packet data string PI, 
and the encryption of several packet segment data strings PIS 1, P1S2, PI S3, P1S4 of that packet 
5 using several encryption steps. It will be understood that the actual operation takes place on a 
large number of packets each of which may well provide a large number of segments for 
encryption. In a simple example, let us assume a packet data string which is broken down into 
packet data segment strings P1S1, P1S2, PI S3, P1S4, with these packet data segment strings 
associated with SA property indicating that encryption algorithm AES is to be applied thereto, 

10 and packet segment data strings P1S5, PIS6, P1S7, P1S8, with these packet data segment strings 
associated with SA property indicating that encryption algorithm DES is to be applied thereto. 
For the system shown in Figure 1-7 and described above, a number of scenarios exist. For 
example, assuming the packet segment data strings are applied to the DUT in the order PI S 1- 
P1S8, and the packet segment data string P1S1 is applied to the encryption engine E0, the 

1 5 possible scenarios for packet segment data strings P 1 S 1-P 1 S4 are as follows: 
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1 5 It will be remembered that it was assumed that the packet segment data string P 1 S 1 was 

applied to encryption engine EO. The alternative is that the packet segment data string P1S1 was 
applied to encryption engine El . Following the above analysis, this results in another eight 
possible scenarios (thus far total of 16 possibilities). 
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It will also be remembered that it was assumed that the packet segment data strings are 
applied to the DUT in the order PI S 1-P1S8. However, the packet segment data strings can be 
applied to the DUT in any order. That is, the (four) packet segment data strings P1S1-P1S4 (to 
which the encryption algorithm AES is to be applied, i.e., the packet segment data strings P1S1- 
5 P1S4 are to be associated with encryption engines EO, El) can be applied to the DUT in 4! or 
4X3X2X1= 24 possible orders. Thus, the possible total number of encryption variations for 
the packet segment data strings P1S1-P1S4 is 16 X 24 = 384. 

Repeating this approach for packet segment data strings P1S5, P1S6, P1S7, P1S8 
(associated with SA property indicating that encryption algorithm DES is to be applied thereto), 
10 another 384 possible scenarios are added, resulting in a total of 768 encryption variations. 

It will readily be seen that the number of encryption possibilities is very large, even in the 
relatively simple situation described, i.e., a given packet segment data string to which the 
encryption algorithm AES is applied can take any one of 384 encrypted forms. 

While it would be of course desirable to test the encryption function of the DUT for 
1 5 proper operation thereof, i. e., that the encrypted packet data string is as expected, the matching 
of resulting encrypted packet data segment against each of the possible encrypted forms is 
impractical, because of the very large number of possible encrypted forms. 

Therefore, what is needed is a method for testing the encryption function of a device, 
which method is simple and effective in use. 

20 

DISCLOSURE OF THE INVENTION 



A packet data string is provided to a device under test (DUT), which preprocesses the 
packet data string, based on static inputs, to provide packet segment data strings, which are 

25 placed in a queue in a memory structure. Separate therefrom, a packet segment data string is 

applied to an encryption engine of the DUT, which encryption engine has an initialization vector 
applied thereto, and an encryption algorithm of the encryption engine is applied to this packet 
segment data string to provide an encrypted packet segment data string. Bit length and 
initialization vector matching techniques are used to eliminate packet segment data strings in the 

30 queue from further consideration, and after bit length and initialization vector matching are 

achieved in regard to a packet segment data string in the queue, such packet segment data string 
is encrypted using the encryption algorithm and an initialization vector extracted from the 
previously encrypted packet segment data string, whereupon a bitwise comparison is made 
between the encrypted packet segment data strings. 

35 The present invention is better understood upon consideration of the detailed description 

below, in conjunction with the accompanying drawings. As will become readily apparent to 
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those skilled in the art from the following description, there is shown and described an 
embodiment of this invention simply by way of the illustration of the best mode to carry out the 
invention. As will be realized, the invention is capable of other embodiments and its several 
details are capable of modifications and various obvious aspects, all without departing from the 
5 scope of the invention. Accordingly, the drawings and detailed description will be regarded as 
illustrative in nature and not as restrictive. 

BRIEF DESCRIPTION OF THE DRAWINGS 

10 The novel features believed characteristic of the invention are set forth in the appended 

claims. The invention itself, however, as well as said preferred mode of use, and further objects 
and advantages thereof, will best be understood by reference to the following detailed description 
of an illustrative embodiment when read in conjunction with the accompanying drawings, 
wherein: 

1 5 Figures 1-7 illustrate an encryption process wherein a device under test (DUT) uses 

cipher block chaining for encryption of a data string in accordance with the prior art; 

Figures 8-15 illustrate the encryption process wherein a device under test (DUT) uses 
cipher block chaining for encryption of a data string in accordance with the present invention; 
and 

20 Figure 16 includes Figures 16A and 16B and illustrates the flow of method steps of the 

present invention. 

BEST MODE(S) FOR CARRYING OUT THE INVENTION 

25 Reference is now made in detail to a specific embodiment of the present invention which 

illustrates the best mode presently contemplated by the inventors for practicing the invention. 
Such embodiment is illustrated in Figures 8-15, and also in the flow diagram of Figure 16. 

As shown in Figure 8, a packet data string PI is applied to a device under test (DUT), and 
a preprocessing function is undertaken, wherein the segmentation function of the DUT is used to 

30 break down the packet into a series of packet segment data strings P 1 S l(pp), P 1 S2(pp), P 1 S3(pp) 
PI S4(pp), based on the set or fixed (static) properties of the packet data string (i. e., packet 
properties, DUT settings, and Security Association (SA) properties). While the packet segment 
data string is associated with an S A property indicating and determining the encryption algorithm 
to be applied thereto, i.e., either AES or DES, no encryption function is undertaken in the 

35 preprocessing function. The plurality of unencrypted packet segment data strings are then placed 
in a queue in a memory structure MS. 
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Similar to the above description, and with reference to Figure 9, the DUT includes four 
encryption engines, noted at EO, El, E2, E3. Each encryption engine includes an encryption 
algorithm, each encryption engine EO, El including the encryption algorithm AES, while each 
encryption engine E2, E3 includes the encryption algorithm DES. The original packet data string 
5 PI is associated with the security association (SA) property which indicates and determines the 
algorithm to be applied thereto, which indication is passed on and associated with each segment 
data string P1S1, P1S2, P1S3, P1S4. 

Initially, each encryption engine has applied thereto a chosen and known initialization 
vector or key, for example, encryption engine EO has applied to thereto initialization vector 

10 IVAESO, encryption engine El has applied thereto initialization vector IVAES1, encryption 
engine E2 has applied thereto initialization vector IVDESO, and encryption engine E3 has 
applied thereto initialization vector IVDES1. 

Separate from the preprocessing operation described above, and with regard to Figure 9, 
the packet data string PI is applied to a device under test (DUT), and the segmentation function 

1 5 thereof is used to break down the packet P 1 into a series of packet segment data strings P 1 S 1 , 

P1S2, PI S3, P1S4, based on the set or fixed (static) properties of the packet data string described 
above. As noted above, the packet segment data strings can be applied to the DUT in any order. 
However, in this example, let us assume that the order is the same as in the Prior Art example 
illustrated and described above. One of the packet segment data strings P1S1 is applied to a 

20 cross-switch (CSW) of the DUT. As indicated above, this packet segment data string PI SI is 

associated with SA property indicating the encryption algorithm to be applied to that data string. 
An input signal IS is applied to the CSW, which input signal is a function of the packet SA 
property indicating the encryption algorithm to be applied. For example, if that packet S A 
property indicates that algorithm AES is to be applied to the packet segment data string PIS 1, the 

25 CSW will receive the data string and apply it to either encryption engine EO or encryption engine 
El, both of which include the encryption algorithm AES. The decision whether to select 
encryption engine EO or encryption engine El is undertaken as described above, i. e., the 
decision depends on which such encryption engine is free for operation (if both encryption 
engines EO, El are free, the system is preset to select one of them - if both encryption engines 

30 EO, El are in use, the encryption engine which becomes free first is selected). 

In accordance with the above, a packet segment data string PI SI is applied to either 
encryption engine EO, which has initialization vector IVAESO applied thereto, or to encryption 
engine El, which has initialization vector IV AES 1 applied thereto. A record is kept of the 
initialization vectors (in this case IVAESO, IVAES1), either of which can be expected to have 

35 been in involved in the encryption. Let us assume that the packet segment data string PI SI is 
applied to encryption engine El (Figure 9). An encrypted packet segment data string ePISI, 
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based on the encryption algorithm AES, issues from the DUT. Included with this encrypted 
packet segment data string ePISI is an initialization vector which should correspond to the 
initialization vector actually applied in the encryption, i.e., in this case IVAES1. 

Let us assume that we wish to check the encryption function of the DUT in encrypting 
5 that particular packet segment data string P 1 S 1 . Initially, a packet segment data string is 

retrieved from the queue of the memory structure MS (Figure 8), and the bit length thereof is 
compared with the bit length of the encrypted packet segment data string eP 1 S 1 . If a match of 
bit lengths is not found, another packet segment data string is retrieved from the queue of the 
memory structure MS, and the bit length comparison is repeated, and so forth, until a bit length 

10 match is found. If a bit length match is not found with any of the packet segment data strings in 
the queue, it is confirmed that the DUT encryption operation is erroneous. 

Once a bit length match is found between the encrypted packet segment data string ePISI 
and a packet segment data string in the queue, the initialization vector with the encrypted packet 
segment data string ePISI is extracted therefrom and is compared to the possible initialization 

15 vectors which could have been applied in the encryption, i.e., initialization vector IVAESO and 
IVAES1, either of which could be expected to have been applied in accordance with the records 
kept as noted above. If no match is found between the initialization vector with the encrypted 
packet segment data string ePISI and either initialization vector IVAESO or initialization vector 
IVAES1, it is understood that the DUT encryption operation is erroneous. If a match is found 

20 between the initialization vector with the encrypted packet segment data string and either 

initialization vector IVAESO or initialization vector IVAES1, the initialization vector extracted 
from the encrypted packet segment data string is applied with the encryption algorithm AES to 
the matching-length packet segment data string retrieved from the memory structure MS to 
encrypt the preprocessed packet segment data string to provide an encrypted version thereof. 

25 This encrypted packet segment data string based on the preprocessed packet segment data string 
is compared bitwise with the initially issued encrypted packet segment data string ePISI. If a 
bitwise match is found, it is understood that the operation of the encryption function of the DUT 
in encrypting the packet segment data string PI SI has been confirmed. If a bitwise match is not 
found, the length-matching process is repeated, using the encrypted packet segment data string 

30 ePISI initially issued from the DUT and another packet segment data string retrieved from the 
queue. If a bitwise match is not found after going through this process for all the packet segment 
data strings in the memory structure MS, it is confirmed that the DUT encryption operation is 
erroneous. 

The following example will illustrate the minimal number of steps involved in the above 
35 procedure. Let us assume in the above example the worst-case scenario that the bit length of the 
encrypted packet segment data string ePISI matches each of the bit lengths of the packet 
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segment data strings PlSl(pp), PlS2(pp), PlS3(pp), PlS4(pp) in the queue, i.e., none of the 
packet segment data strings in the queue can be eliminated on the basis of non-matching bit 
lengths. Let us assume that after finding initialization vector matching and after encrypting that 
first-accessed packet segment data string PI SI in accordance with the above, a bitwise match is 
5 not found. At this point, one does not know whether the failure to find a bitwise match is due to 
an encryption error or is due simply to the fact that the packet segment data string from the queue 
does not correspond to the packet segment data string P1S1 which was encrypted. Then, let us 
assume that after another (second-accessed) packet segment data string is accessed from the 
queue, and after encryption thereof in accordance with the above, a bitwise match is again not 

10 found. Again, one does not know whether the failure to find a bitwise match is due to an 

encryption error or due simply to the fact that the packet segment data string from the queue does 
not correspond to the packet segment data string PI SI which was encrypted. Next, let us assume 
that after another (third-accessed) packet segment data string is accessed from the queue, and 
after encryption thereof in accordance with the above, a bitwise match is again not found. Again, 

15 it is not known whether the failure to find a bitwise match is due to an encryption error or due 
simply to the fact that the packet segment data string from the queue does not correspond to the 
packet segment data string P1S1 which was encrypted. When the next (last, fourth-accessed) 
packet segment data string is accessed from the queue and is encrypted in accordance with the 
above, it will be determined whether the encryption function of the DUT has been confirmed or 

20 is erroneous. 

It will readily be seen that after confirmation of initialization vector matching as set forth 
above, this is the maximum number of steps (four) necessary to confirm the encryption function 
of the DUT in regard to the encrypted packet segment data string ePIS 1 issuing from the DUT. 
Next, assuming that the encryption function of the DUT has in this last step been 

25 confirmed, the packet segment data string in the queue which was used in such confirmation is 
removed from the queue, leaving three packet segment data strings in the queue. 

Then, with reference to Figures 10 and 1 1, another packet segment data string PI S2 is 
applied to a cross-switch (CSW) of the DUT. As indicated above, this packet segment data 
string P1S2 is associated with SA property indicating the encryption algorithm to be applied to 

30 that data string. An input signal IS is applied to the CSW, which input signal is a function of the 
packet SA property indicating the encryption algorithm to be applied. For example, if that packet 
SA property indicates that algorithm AES is to be applied to the packet segment data string P1S2, 
the CSW will receive the data string and apply it to either encryption engine E0 or encryption 
engine El , both of which include the encryption algorithm AES. The decision whether to select 

35 encryption engine E0 or encryption engine El is undertaken as described above, i. e., the 
decision depends on which such encryption engine is free for operation (if both encryption 

10 
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engines EO, El are free, the system is preset to select one of them - if both encryption engines 
EO, El are in use, the encryption engine which becomes free first is selected). 

In accordance with the above, packet segment data string P1S2 is applied to either 
. encryption engine EO or encryption engine El. As set forth above, one of the initialization 
5 vectors has been changed (with encryption engine El used in the previous encryption, the 

initialization vector IVAES1, previously applied to encryption engine El, has been changed to 
initialization vector IVAES2). The record of the initialization vectors is updated, so that the 
record now indicates initialization vectors IVAESO, IVAES2 (Figure 10) either of which could 
be expected to have been involved in the encryption of packet segment data string P1S2. Let us 

10 assume that the packet segment data string P1S2 is applied to encryption engine EO. An 

encrypted packet segment data string ePlS2, based on the encryption algorithm AES, issues from 
the DUT (Figure 11). Included with this encrypted packet segment data string ePl S2 is an 
initialization vector which should correspond to the initialization vector actually applied in the 
encryption, i.e., in this case IVAESO. 

15 The length-matching and initialization vector matching steps are undertaken as set forth 

above, but now only with three packet segment data strings in the queue. Thus, after 
initialization vector matching as described above, now based on the updated record of the 
initialization vectors, the maximum number of further steps necessary to confirm the encryption 
function of the DUT in regard to this encrypted packet segment data string ePlS3 is three. 

20 Next, assuming that the encryption function of the DUT has in this last step been 

confirmed, the packet segment data string in the queue which was used in such confirmation is 
removed from the queue, leaving two packet segment data strings in the queue. 

Then, with reference to Figures 12 and 13, another packet segment data string PI S3 is 
applied to either encryption engine EO or El . In accordance with the above description, one of 

25 the initialization vectors has been changed (with encryption engine EO used in the previous 
encryption of packet segment data stream P1S2, the initialization vector IVAESO, previously 
applied to encryption engine EO, has been changed to initialization vector IVAES3). The record 
of the initialization vectors is updated, so that the record now indicates initialization vectors 
IVAES3, IVAES2 (Figure 12), either of which could be expected to have been involved in the 

30 encryption of the packet segment data string P 1 S3 . Let us assume that the package segment data 
string PI S3 is applied to the encryption engine El (Figure 13). An encrypted packet segment 
data string ePl S3, based on the encryption algorithm AES, issues from the DUT. Included with 
this encrypted packet segment data string ePlS3 is an initialization vector which should 
correspond to the initialization vector actually applied in the encryption, i.e., IVAES2. 

35 The length-matching and initialization vector matching steps are undertaken as set forth 

above, but now only with two packet segment data strings in the queue. Thus, after initialization 
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vector matching as described above, now based on the updated record of the initialization 
vectors, the maximum number of further steps necessary to confirm the encryption function of 
the DUT in regard to this encrypted packet segment data string ePl S3 is two. 

Next, assuming that the encryption function of the DUT has in this last step been 
5 confirmed, the packet segment data string in the queue which was used in such confirmation is 
removed from the queue, leaving one packet segment data string in the queue. 

Then, with reference to Figures 14 and 15, the last packet segment data string P1S4 is 
applied to either encryption engine EO or El. In accordance with the above description, one of 
the initialization vectors has been changed (as encryption engine El was used in the previous 

10 encryption of packet segment data string PI S3, the initialization vector IVAES2, previously 

applied to encryption engine El, has been changed to initialization vector IVAES4). The record 
of the initialization vectors is updated, so that the record now indicates initialization vectors 
IVAES3, IVAES4 (Figure 14), either of which could be expected to have been involved in the 
encryption of the packet segment data string P1S4. Let us assume that the packet segment data 

15 string P1S4 has been applied to the encryption engine El . An encrypted packet segment data 
string ePlS4, based on the encryption algorithm AES, issues from the DUT. Included with this 
encrypted packet segment data string is an initialization vector which should correspond to the 
initialization vector actually applied any encryption, i.e., IVAES4. 

The length-matching and initialization vector matching steps are undertaken as set forth 

20 above, but now only with one packet segment data string in the queue. Thus, after initialization 
vector matching as described above, now based on the updated record of the initialization 
vectors, the maximum number of further steps necessary to confirm the encryption function of 
the DUT in regard to this encrypted packet segment data string ePlS4 is one. 

It will be noted that with the present approach, the maximum number of checks necessary 

25 for packet data string P 1 , which is segmented into four packet segment data strings P 1 S 1 , P 1 S2, 
PI S3, P1S4, is 4 + 3 + 2+1 = 10, as compared to the 384 possibilities described above. 

It will be seen that a practical method for testing the encryption function of a device 
under test has been achieved. In the present process, bitwise comparison is not undertaken until 
a very large number of packet segment data string have eliminated from consideration (i.e., no 

30 length match and/or no initialization vector match). Only when both these matches are realized 
is the encryption function applied to a packet segment data string in furtherance of bitwise 
comparison. Thus, a practical method for testing the encryption function of a device is achieved. 

The foregoing description of the embodiment of the invention has been presented for 
purposes of illustration and description. It is not intended to be exhaustive or to limit the 

35 invention to the precise form disclosed. Other modifications or variations are possible in light of 
the above teachings. 
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The embodiment was chosen and described to provide the best illustration of the 
principles of the invention and its practical application to thereby enable one of ordinary skill of 
the art to utilize the invention in various embodiments and with various modifications as are 
suited to the particular use contemplated. All such modifications and variations are within the 
scope of the invention as determined by the appended claims when interpreted in accordance 
with the breadth to which they are fairly, legally and equitably entitled. 
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